2.14 Ensure 'sa' Login Account has been renamed

Information

The sa account is a widely known and often widely used SQL Server login with sysadmin privileges. The sa login is the original login created during installation and always has principal_id=1 and sid=0x01.

Rationale:

It is more difficult to launch password-guessing and brute-force attacks against the sa login if the name is not known.

Solution

Replace the <different_user> value within the below syntax and execute rename the sa login.

ALTER LOGIN sa WITH NAME = <different_user>;

Impact:

It is not a good security practice to code applications or scripts to use the sa account. However, if this has been done renaming the sa account will prevent scripts and applications for authenticating to the database server and executing required tasks or functions.

Default Value:

By default, the sa login name is 'sa'.

See Also

https://workbench.cisecurity.org/files/2945

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|5, CSCv7|5.1

Plugin: MS_SQLDB

Control ID: dc418653cda3350aa59ce8a2c377d420e4d965512400b311f9f37ebc054fe3c2